Analysis
-
max time kernel
136s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
27/04/2024, 16:10
General
-
Target
llllllllllllllllllllllllllllllll.exe
-
Size
37KB
-
MD5
e3a969b6c2dd0cea41858f823da862fb
-
SHA1
b7791b79d9c97653bca2b7e18d1c3e871002c8d3
-
SHA256
509ee57050cc2db5c0a5f6ac7ba61f33fa4079b23281c056a236a8f4e47316b0
-
SHA512
598011b348f038c14197e7aca1fecce4f6ea76fce3ba2c6a457f8a31bb72ba78620c19c5c196165b717e279f1347f43de58f724fac68ac6268fc5ec2ac2deb2c
-
SSDEEP
768:UXX1qlm/G4iHEq5uvg8lmc3qJy1UraNcgLFyS9f/sOjhYPyl:UVqlX20W8iU2NFFf9fkOjqk
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
62.233.57.44:1488
Mutex
vpqd72LWSwYhw59x
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
aes.plain
Signatures
-
Detect Xworm Payload 1 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\llllllllllllllllllllllllllllllll.exe"C:\Users\Admin\AppData\Local\Temp\llllllllllllllllllllllllllllllll.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB